CVE-2015-2266: Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information
Summary
CVE-2015-2266: Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information. Affects moodle/moodle across 3 version ranges.
< 2.6.9
>= 2.7.0, < 2.7.6
>= 2.8.0, < 2.8.4
Fixed in 2.6.9, 2.7.6 or 2.8.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning activities. It provides a platform for teachers and students to interact, share resources, and participate in discussions. Moodle is widely adopted and offers various features such as messaging capabilities for communication between users.
Vulnerability Detail
The vulnerability (CVE-2015-2266) in Moodle versions prior to 2.6.9, 2.7.6, and 2.8.4 allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information. The issue arises from the 'message/index.php' file, which does not consider the 'moodle/site:readallmessages' capability before accessing arbitrary conversations. This oversight enables attackers to modify the URL and gain unauthorized access to personal-contact information and unread message counts of other users. This information could be exploited for malicious purposes, such as targeted phishing attacks or unauthorized disclosure of sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.92.6.9composer require moodle/moodle:2.6.9 -
>= 2.7.0, < 2.7.62.7.6composer require moodle/moodle:2.7.6 -
>= 2.8.0, < 2.8.42.8.4composer require moodle/moodle:2.8.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the patched versions is the recommended solution.
Conclusion
The vulnerability in Moodle versions prior to 2.6.9, 2.7.6, and 2.8.4 allows attackers to obtain sensitive personal-contact and unread-message-count information. Upgrading to the patched versions is crucial to mitigate the risk of unauthorized access and potential misuse of user data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used by educational institutions to create online courses and manage learning activities.
The vulnerability allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information of other users, which could be exploited for malicious purposes.
To fix this vulnerability, upgrade to Moodle version 2.6.9, 2.7.6, or 2.8.4, depending on the installed version.
No, there is no specific workaround provided. Upgrading to the patched versions is the recommended solution.
You can find more information about this vulnerability in the provided sources and references.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
